10 ms·
CryptPad: An Alternative to the Google Suite
- righthand 1y agoCryptpad is all right though it locks you into Cryptpad. If you want to extract your documents you have to use their UI to decrypt them. What I am looking for is a document interface that works with Syncthing. Let syncthing handle the syncing and encryption.
- misterdata 1y agoSo, basically any local productivity tool, saving files in a synced folder. While this works, Syncthing does not really provide anything for fine-grained collaboration or sharing (you only share full folders). Encrypted peers do allow storing files on a machine that you don’t have to trust.
- righthand 1y agoI don't need anything from Syncthing for fine grained collaboration, the text editors do that.
- andai 1y agoWhat are you looking for? I used to use Notational Velocity in an encrypted volume hosted on Dropbox, but I ended up switching to Obsidian for the mobile support.
- righthand 1y agoI’m not actually looking, Syncthing solves 90% and I’m hard pressed to believe anyone needs live document collaboration outside of an office context that screensharing doesn’t already solve. Most of the time when everyone “collaborates”, only 1-2 people of the group are doing the typing.
- deleted 1y ago[deleted]
- ldubost 1y agoI'm from the CryptPad team This workflow works for you ! Great ! Unfortunately, most users don't know how to setup the tools you are talking about. Additionally they end up having to share some document at some point or another. They end up with browser based tools and a shared server. Google most of the time for individuals. Most users want their data in one place for all use cases. Network effects make it so that only tools that allow you to invite anybody to your document (guests without accounts included) end up gaining traction. Desktop apps might be able to achieve this using some web proxy so who knows, it might change in the future. Our goal at CryptPas is to make it familiar for them to move from Google while having e2ee here to protect their privacy, which also gives them a reason to switch The more people can get out, to any open alternative, the more alternatives can then decide to fight each other. In the mean time, we should not try too much to get the rest of the world on our own workflow, just let all the different approaches strive. BTW maybe CryptPad's API ( https://github.com/cryptpad/cryptpad-api-examples https://github.com/cryptpad/cryptpad-api-examples ) could help you solve the case where you do need to edit a document collaboratively from your computer. Would you be interested in a tool allowing to create a session for editing with CryptPad allowing to sync back changes or save the end result back to your computer ? Ludovic
- colordrops 1y agoAlso no easy way to import everything from Google drive.
- aaravchen 1y agoYou have to download everything in your Drive to your local system first, then unzip it all, but then you can upload the entire folder to CryptPad. Google isn't going to make it easy for a competitor to transfer content, and I'd rather the CryptPad devs work on the product and not a feature users will each only use once at most. The only annoyance I had was "converting" the uploaded files to the "native" CryptPad format. It doesn't actually have a different native type, it just seems to be a registering with the CryptPad internals which of its predefined types the file is (E.g. Document, Presentation, etc). And you don't have to do it for the file to open and edit just fine. But you have to open each file "as <Type>" from the right click menu, then save it back out and delete the "original" to convert it.
- j45 1y agoOnboarding is a big one time feature to get users to first value.
- ldubost 1y agoTrue.. Now for "first value" we have "create a pad in one click to work with your friends", also 1gb data for free. There is Google Takout + Folder import to do mass imports. There is work possible to improve but also through the browser it's tricky to make large volume imports reliable. Best path is an API which would also allow backup tools and down the line local syncing. Overall for people wanting more of CrytpPad, think about donating on OpenCollective https://OpenCollective.com/cryptpad https://OpenCollective.com/cryptpad Ludovic from the CryptPad Team
- sillyfluke 1y agoI came across cryptpad as cryptpad.cz but couldn't figure out who was behind it at the time. At least with this link you can get to at least one seemingly legit dev, which makes me take it more seriously. Is cryptpad.cz a fork of this or vice versa?
- Tomte 1y agoCryptPad is developed by XWiki as a side project.
- sillyfluke 1y agoDo you know of any publicized auditing done on the E2E aspect of it? Curious about that since it's part of the name and a prominent publicized feature.
- ldubost 1y agoI'm from the CryptPad team There is our white paper on the security features of CryptPad: https://blog.cryptpad.org/2023/02/02/Whitepaper/ https://blog.cryptpad.org/2023/02/02/Whitepaper/ In terms of audits, we don't have the funding for formal audits but a couple years ago the European Community paid a bug bounty https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en https://commission.europa.eu/news/european-commissions-open-... We received some interesting reports but not as much on the cryptography than on web related issues Ludovic
- sillyfluke 1y agoThanks. Isn't vouching for other online instances a bit risky? Wouldn't you have to constantly verify the source is unmodified in an automated fashion for those instances you don't control?
- ldubost 1y agoInteresting point. We should add some warnings about this. Ludovic, from the CryptPad team.
- nout 1y agoOne option for you that's half way there is to use Obsidian on top of markdown files and sync those with Syncthing. Obsidian has many of the rich editing capabilities, especially when you install plugins. For plus points the files are very portable and there is (almost) no "vendor lock in" because it's all markdown textfiles.
- SkyMarshal 1y agoOr just use Obsidian's built-in E2E encrypted syncing. https://obsidian.md/sync https://obsidian.md/sync But yeah, since it stores everything as flat markdown files, you can sync or archive your Obsidian docs folder with anything.
- dtkav 1y agoI'm building a plugin for Obsidian called Relay that makes Obsidian real-time collaborative [0]. It isn't end-to-end encrypted (yet), but you can self host the document collaboration server on a private network (like tailscale). If you're like me and you need real-time collaboration and privacy but e2ee isn't a strict requirement for your collaborative docs then you might enjoy it. I also use Obsidian sync for e2ee device sync -- it is a fantastic product. [0] https://relay.md https://relay.md
- sadeshmukh 1y agoI love this setup. I've now synced between my phone and laptop, with a backup on a cloud server, and it deserved a post on my fledgling blog: https://blog.sahil.ink/obsidian-and-syncthing/ https://blog.sahil.ink/obsidian-and-syncthing/
- lysace 1y agoI've been a heavy Google Docs/Sheets/etc user since they launched almost two decades ago (2006). I've exported to structured formats a handful of times, out of thousands of documents. CryptPad really should build this though.
- bjelkeman-again 1y agoI had to export all of our documents and sheets out of Google Drive. I used something called Google Take Out, that packages everything and puts it somewhere where you can download zip files. It took a few days for it to be available. Except it didn’t do what it said it did. It didn’t export even half the files. I unpacked and compared with what was online. In the end I had to download folders by hand. Took me half a day. And make sure they weren’t too big, because then it wouldn’t include everything.
- ldubost 1y agoI'm not sure which export you are talking about ? We have xlsx/docx/pptx import export (one by one). What we don't have is local syncing with your computer. Ludovic, from the CryptPad team
- lysace 1y agoThat's all I wanted. I'm sorry that I was misled to indicate that you lacked this.
- jraph 1y agoSynching is for syncing your files across several devices of yours. CryptPad is for working with other people, possibly at the same time on the same document. The tools donc comapte, the needs are very different, and you might find them both useful in different situations. It seems to me syncthing simply doesn't need anything more, you just use the desktop application of your choice for editing your documents. And yes, you are kinda locked into CryptPad if you don't export your documents as you go. The server not having your documents at a central place and all the documents having different decryption keys means it's hard to provide a simple "take out" zip export. I guess some automation tool accessing your browser profile could be built to help with this.
- creshal 1y agoThe problem is cryptpad pretends to solve the problem with its "drive", but it's just a (not very) fancy browser for your documents. I can't make a folder with a cryptpad document in it and also all the reference material I want to use. Or any other workflow that involves multiple kinds of files of different types. Manually copying over everything between cryptpad and syncthing is a consistency nightmare.
- ldubost 1y agoWe never pretended the drive has local syncing. The drive is extremely useful for people to organize their documents inside CryptPad. It is possible to create folders with any file types in it. Shared folders can be also created. The workflow you describe with syncthing involves local synching. We are not saying that syncing locally is not interesting. It's just a lot more work on top of the editor work, the online sharing, the e2ee, etc.. We work with the capacity we have. Also as I said, syncing opens the door to version compatibility issues, risks of mistakenly deleting data of your drive and high volume just for storage. This means for our hosting service (cryptpad.fr) management of much higher volumes. We are not even sure the 1gb free storage policy is sustainable for that use case. But we are working on a path towards this as we have plans for a CryptPad API. Ludovic, from the CryptPad team
- ldubost 1y agoI'm from the CryptPad team. We hope to be able to give an API in the future but there are a few concerns to allow sync tools to operate: - server load and volume of data when syncing large volumes of data, especially for our flagship instance. CryptPad is currently used for realtime editing not for large data sync. We already host 6TB of data and it's unclear were that would lead us. - version compatibility with apps not upgraded to the latest version of the API These are similar reasons that kept us away from federation. Our team is small and already a lot of work. Hiring is limited by our funding. Ludovic
- nunobrito 1y agoHey Ludovic, just to give a shout of appreciation for your hard work over the years. Keep rocking!
- ldubost 1y agoThanks on behalf if the team. Ludovic
- creshal 1y agoI feel you, but Drive is borderline useless and I can't sell any potential users on "you put all your data here but documents go there (but it still looks like you could put other stuff here but that's an illusion) unless you manually export them and then everything gets weird" - I'll count myself lucky if I can finish the sentence before they renew their existing cloud service.
- ldubost 1y agoDrive might be 'useless' to you in it's form because you want more from CryptPad (more features in it, more local sync, more anything), but it is very useful to organize your docs that you work on in CryptPad. It also allows shared folders and so on. What's interesting is that surveying our users did not show local sync as hugely demanded. Mobile access comes up the highest.
- 1y ago
- hmsimha 1y agoI think there are some issues with cryptpad, most significantly that documents which are shared via their share link (default way of sharing) will effectively be shared with Google, Apple, Microsoft, and so on. I think this is dangerous because some users may be under the impression that Cryptpad secures their documents from the prying of big tech's eyes, but since it's guaranteed that at least some document collaborators will be using those companies' browsers, and browser history is synced, the URLs (which contain the key to decrypt the document after the fragment) to any document which is shared with more than handful of cypherpunks will certainly end up shared with the main browser vendors Additionally, they've failed to make some architectural and delivery decisions which would protect users from various attacks like a server compromise (for example, a server seized by an adversary may send malicious client code that conducts a document exfiltration), as well as document exfiltration via a malicious browser extension. Both of these can be mitigated somewhat by delivering the frontend as a desktop app or signed browser extension, and setting reasonable CSPs in the decryption modules. This is exactly the reason Signal doesn't offer a web app. Cryptpad does offer the ability to additionally encrypt documents with shared passwords, and this offers a fair modicum of greater protection against document interception. But this isn't the default document mode, so I doubt most documents are password-protected in practice. I did share all of the above with the Cryptpad team, and was told they don't intend to address the above issues, so I'd recommend against putting to much faith in them for the time being.
- rkagerer 1y ago...and any document which is shared with more than handful of cypherpunks will certainly end up shared with the main browser vendors Can you suggest some best practices those cypherpunks can take to mitigate the weaknesses and use it in a secure fashion? Eg. I don't sync browser history and tend to turn off other cloud-supported features (including "logging into" my browser).
- hmsimha 1y agoRegarding the URLs containing the decryption key, of course a strong password is a big benefit here, but if you're not syncing history that could perhaps eliminate big tech from the loop (though you may also need to turn off all telemetry by your browser) Using a browser without extensions installed would prevent against extension-based exfiltration. The only way to prevent against a malicious server would probably be to build the frontend yourself and use it with the server (I haven't tried doing this)
- mupuff1234 1y agoWhy is this dubbed as an alternative to Google suite and not Microsoft suite? They even used the Microsoft icons.
- crtasm 1y agoWhile Google is mentioned in some of the user testimonials I don't think the submitter should have added it to the title here.
- george_perez 1y agoI think because it's web-based only, much like Google Docs and the like are. For my Cryptpad replaced Google Docs as a live-collaboration tool.
- rspoerri 1y agoRealtime collaborative text editing is afaik something Microsoft is not doing.
- indigodaddy 1y agoCan you not effectively use it as such, however?
- okanat 1y agoIt is there with Office 365 and VS Code live share. They were among the first to make a complete and commercially successful coediting experience.
- FuriouslyAdrift 1y agoThe webified version of Office goes back years. It used to be a free add-on to SharePoint and allowed up to 64 simultaneous users per document. I believe the current Office 365 came from that codebase as it has similar features.
- crimsoneer 1y agoWhen cryptpad was first launched, MS Office was very much a desktop product and Google was the web first collaboration platform. That's obviously because (a teeny bit) less true.
- ocdtrekkie 1y agoHonestly my primary peeve with Cryptpad is the incredible load time... which is justified in scenarios of private documents, but completely unjustified in every single time someone shares a Cryptpad link with me which is certainly intended for public consumption.
- ldubost 1y agoWe have started working on that. The load time currently depends on the size of your drive/share folders etc.. Public links are now bypassing some actions. We hope to bypass more in the future Ludovic
- throwaway984393 1y ago[dead]
- weinzierl 1y agoThere are other free instances available, for example cryptpad.digitalcourage.de is used by many people I know. See cryptpad.org/instances for a list.
- aaravchen 1y agoI really appreciate that the team hasn't rested on their laurels with just creating an encrypted cloud-based OnlyOffice wrapper and they've actively pushed I to the space of filling tool gaps. Their markdown files are a nice addition for a simple note that doesn't need to be a full Document.
- dbbk 1y agoThis looks awful, is it from the 90s?
- emilfihlman 1y agoHow does this compare with the French/German https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs ?
- jraph 1y agoCryptpad is E2E encrypted. At a first glance, this is not. Which also means its features won't be constrained by the E2EE architecture. At a first glance, it seems the suite numerique wants to be simpler than full traditional office documents. It seems to compare itself with notion and outline. CryptPad has very simple modules and also more complex, OnlyOffice based modules. Ultimately, if the suite numerique's frontend is able to send editing patches as JSON, it should not be too complicated to make it work on a CryptPad server and make it E2EE, which is exactly what the CryptPad team did to OnlyOfficr (the "why not both" option)
- ldubost 1y agoI'm from the CryptPad team. It would not really make any sense to try to take all Docs in CryptPad, as Docs is both client and server code. The client has both and editor but also sharing features. CryptPad integrates editors. However Docs is based on BlockNote for the editor and this editor has been on our watchlist to replace our aging CKEditor which is used in CryptPad. This would make sense to integrate in CryptPad. As it was said CryptPad is e2ee which is a LOT of work. Then it has 9 types of document files (Docs has 1). CryptPad also has a drive. It also has shared folders, team drives, import and export features and finally also a Survey Tools with e2ee protection. There are many more little or larger details. Ludovic
- emilfihlman 1y agoThank you for the reply! Of course as a part of the Cryptpad team you have a bias, but if I'm looking to replace Google Drive and its functionality, is Cryptpad a good replacement, or is there another one, maybe Nextcloud(?), that could do it better (just user interaction etc wise, not E2EE)? Would you have a list of things Cryptpad can and can't do compared to other solutions? It would make choosing the best replacement easier.
- deleted 1y ago[deleted]
- AdolpheGMartin 1y agoSee also: https://etherpad.org https://etherpad.org
- leelou2 1y ago[flagged]
- dtkav 1y agoIn the AI age having all of your files in markdown and away from AI enabled providers is making more and more sense. I know of several AI companies who use bespoke tools because otherwise their data would be shared with their competitors (e.g. notion -> openai, gdocs -> google, etc). It used to be that putting your docs on google "felt" safe because it was unlikely that some random google employee would read you random company docs. Now it seems unlikely to me that they aren't reading every doc with AI.
- jacooper 1y agoThis gotta be an LLM
- Fire-Dragon-DoL 1y agoI tried cryptpad and it was good, with the main issue being inviting new users is really complicated. Users needed to register and then send their own "invite me" link, because the system encrypted their email address, so you can only use the link to invite them. This turned out too complicated for normal people (ok for computer users)
- jraph 1y agoThe normal way to invite people to a CryptPad document is to give them the shared link. No need to register or involve emails. Then, they just need to follow the link and it should just work. CryptPad is specifically designed with nontechnical users in mind, because if you want something to be secure, it needs to be simple, and it is not desirable for privacy to be limited to technical users only. What did you want to achieve?
- Fire-Dragon-DoL 1y agoSorry I should have been more specific, I was trying to invite a user to a team (can't remember the right terminology) so that they could read and write into a directory, creating as many document as they wanted. We are a small team of 5, but I'm the only tech-able person, other older users felt extremely disoriented. Which is frustrating, because to me Cryptpad did everything we needed in a very, very secure way (all encrypted)
- ldubost 1y agoHi, I'm from the CryptPad team. This is an interesting feedback. Note that you can also invite people by sending them a link to a document and then connect to them from the user sidebar. They don't really need an account to access documents. The main reason for the lack of simpler invitation using email is that we don't really want users to give us the mail of other users to invite. This goes against the "privacy" we are promising users. Ludovic
- Fire-Dragon-DoL 1y agoHi! Thank you for answering this. We are essentially a group of people (home-owner association but for condos, in Canada). None of these are tech people, they also might not own a computer, but just a tablet and a phone. The main issue was trying to invite them to a team. I had all their email addresses already, because our main form of communication is email, but I had to go to them one by one and ask them for a link (ID? I can't remember) to give to me so that I could invite them. Essentially, I get the privacy concern, but I already had all their email addresses, so it was protecting data and making a workflow more complicated, for a use-case we didn't have.
- rodolphoarruda 1y agoI have been working on an essay about 'Personal Digital Infrastructures,' a concept of infrastructure that seeks resilience and durability for personal data at a level we typically only see in banks or state institutions. In other words, an infrastructure that can protect your personal data in the face of disasters such as big tech account cancellations, fund blocking, imprisonment, bankruptcy, death, etc. The flagship instance of Cryptpad is the service that comes closest to this idea of infrastructure. The free plan gives you 1GB of storage for files, which is more than enough to store essential data for the continuity of businesses, families, communities, etc. E2E encryption plus zero trust in a free tier is something that should be valued and used to our advantage. Cryptpad is a very powerful resource and should be more appreciated.
- hoerzu 1y agoIs there a Google Keep alternative?
- rodolphoarruda 1y agoIn the Cryptpad service? No. Not with the same UX. But you can keep simple markdown notes in it.
- eointierney 1y agohttps://elpa.gnu.org/packages/crdt.html https://elpa.gnu.org/packages/crdt.html is much more fun and, obviously, vastly more powerful.
- laxmin 1y agoWe (a University, in India) are trying to get out of the Google ecosystem, and CryptPad is the greatest thing that has happened to us. Google has been whittling the 'Google for Education' now and the free version called 'fundamentals' has been stripped of many things and we can see the future where the cost of using Google might be a significant impactful expenditure on our tight, already stretched to the limits budget. Also, the word, 'Crypt' is cool. Our teachers feel like Hackers. Seriously - that was some of the great feedback we received.
- flashblaze 1y agoMay I ask why not Zoho?
- Happily2020 1y agoNot OP, but I feel like moving from Google to Zoho is just kicking the can down the road. You don't know how these big corporations will change their product or (more importantly for cash strapped organisations like Universities) their pricing structure. It seems like a much safer to bet to move to an open source project instead. The costs of hosting it would be well known and predictable.
- deafpolygon 1y agoWhich is funny because if you want lock-in there's no better way than to offer end-to-end encryption.
- Tepix 1y agoDoes it prevent you from exporting the data, changing the vendor, changing the application? I think you have a wrong view of „lock-in“
- freedomben 1y agoI'm a big fan of Zoho and I use them for one of my organizations, but having an open source option is huge and a massive selling point even over Zoho.
- jszymborski 1y agoI use CryptPad all the time and it rocks!
- gitroom 1y agoyep i've played with cryptpad and honestly it's wild how much comes down to people stubbornly sticking with the default tools - you think we ever get to a point where open options like this really catch on outside techy circles or will it always be a niche thing